The vulnerability CVE-2024-47331 affects Ninja Team's Multi Step for Contact Form plugin versions up to 2.7.7. It is caused by improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. The vulnerability is remotely exploitable without any privileges or user interaction, potentially allowing attackers to access sensitive data (confidentiality impact is high) while causing limited availability impact. The CVSS vector indicates the attack complexity is low and the scope is changed, meaning the vulnerability affects resources beyond the vulnerable component.

Successful exploitation of this SQL Injection vulnerability could allow an unauthenticated remote attacker to access or disclose sensitive information from the backend database. The confidentiality impact is high, but integrity is not impacted, and availability impact is low. This could lead to data leakage or unauthorized data access within the affected application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific temporary mitigations are provided in the available data.